| ID | Name |
|---|---|
| T1497.001 | System Checks |
| T1497.002 | User Activity Based Checks |
| T1497.003 | Time Based Evasion |
Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.
Adversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: Scheduled Task/Job). Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled Multi-Stage Channels to avoid analysis and scrutiny.[1]
Benign commands or other operations may also be used to delay malware execution. Loops or otherwise needless repetitions of commands, such as Pings, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.[2][3] Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).[4][5]
Adversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.[6]
| ID | Name | Description |
|---|---|---|
| S0584 | AppleJeus |
AppleJeus has waited a specified time before downloading a second stage payload.[7] |
| S0642 | BADFLICK |
BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.[8] |
| S0534 | Bazar |
Bazar can use a timer to delay execution of core functionality.[9] |
| S0574 | BendyBear |
BendyBear can check for analysis environments and signs of debugging using the Windows API |
| S0611 | Clop |
Clop has used the |
| S0115 | Crimson |
Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.[12] |
| S0554 | Egregor |
Egregor can perform a long sleep (greater than or equal to 3 minutes) to evade detection.[13] |
| S0396 | EvilBunny |
EvilBunny has used time measurements from 3 different APIs before and after performing sleep operations to check and abort if the malware is running in a sandbox.[14] |
| S0512 | FatDuke | |
| S0493 | GoldenSpy |
GoldenSpy's installer has delayed installation of GoldenSpy for two hours after it reaches a victim system.[16] |
| S0588 | GoldMax |
GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.[17] |
| S0632 | GrimAgent |
GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.[18] |
| S0561 | GuLoader |
GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.[19] |
| S0513 | LiteDuke |
LiteDuke can wait 30 seconds before executing additional code if security software is detected.[15] |
| S0447 | Lokibot |
Lokibot has performed a time-based anti-debug check before downloading its third stage.[20] |
| S0439 | Okrum |
Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.[21] |
| S0626 | P8RAT |
P8RAT has the ability to "sleep" for a specified time to evade detection.[22] |
| S0453 | Pony |
Pony has delayed execution using a built-in function to avoid detection and analysis.[23] |
| S0650 | QakBot |
The QakBot dropper can delay dropping the payload to evade detection.[24][25] |
| S0565 | Raindrop |
After initial installation, Raindrop runs a computation to delay execution.[26] |
| S0627 | SodaMaster |
SodaMaster has the ability to put itself to "sleep" for a specified time.[22] |
| S0559 | SUNBURST |
SUNBURST remained dormant after initial access for a period of up to two weeks.[27] |
| S0595 | ThiefQuest |
ThiefQuest invokes |
| S0266 | TrickBot |
TrickBot has used |
| S0386 | Ursnif |
Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.[29] |
| S0658 | XCSSET |
Using the machine's local time, XCSSET waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component |
|---|---|---|
| DS0017 | Command | Command Execution |
| DS0009 | Process | OS API Execution |
| Process Creation |
Time-based evasion will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.